Extracted

• • Target
    e0508e5987a2d4062288edea3e728d37.exe
  • Size 219KB
  • SHA256 c5072261b7b27698e90066a45e204fc5db137427d22133d6a34dfbce68a26e13
  • MD5 e0508e5987a2d4062288edea3e728d37
  • SHA1 b5b8fd66e6b915906b1bfa372e1e9a3ea4413d2f
  • SHA512 eebc1a1815715db08099fce922088924f47fe86a2ea905bfc9636b7adabed0decb4117fb7fcd3f1c5ea495a7f38e29d4a62b42bb089dc1a50987b56d357a12ac
  • SSDEEP 3072:OhOluS4LWS156DDPwWplHCabZt2Mi7zxfROL1T9knTVOWzgKr/so:x+LWLDsWplHd/mz6BT9kxOWzz/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojanamadeycollectiondiscoveryspywarestealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2